User profile for user: gravityfed
gravityfed Author
User level: Level 1
146 points

ANECompilerService

Before you comment to crucify me for looking in logs, please tell me if this compiler looks suspicious, I didn’t post the full log as it’s very very long.


This iPad was factory reset at the Apple Store a few weeks, no additional apps installed. My MacBook Pro and MacMini were both compromised and jailbroken.


I am wondering if this is a persistent ‘horsey’ type issue and my iPad and Macs are now back on the merry-go-round despite factory resets and new AppleID.


{"app_name":"ANECompilerService","timestamp":"2023-03-28 09:42:12.00 +1100","slice_uuid":"","build_version":"1","bundleID":"com.apple.ANECompilerService","duration_ms":"120064","share_with_app_devs":0,"is_first_party":0,"bug_type":"202","os_version":"iPhone OS 16.3.1 (20D67)","roots_installed":0,"name":"ANECompilerService","incident_id":""}
Date/Time:        2023-03-28 09:40:11.292 +1100
End time:         2023-03-28 09:42:11.356 +1100
OS Version:       iPhone OS 16.3.1 (Build 20D67)
Architecture:     arm64e
Report Version:   40
Incident Identifier: 

Data Source:      Microstackshots
Shared Cache:     
Shared Cache:     

Command:          ANECompilerService
Path:             /System/Library/PrivateFrameworks/AppleNeuralEngine.framework/XPCServices/ANECompilerService.xpc/ANECompilerService
Identifier:       com.apple.ANECompilerService
Version:          ??? (1)
Resource Coalition ID: 463
Architecture:     arm64e
Parent:           launchd [1]
PID:              1021

Event:            cpu usage
Action taken:     none
CPU:              90 seconds cpu time over 120 seconds (75% cpu average), exceeding limit of 50% cpu over 180 seconds
CPU limit:        90s
Limit duration:   180s
CPU used:         90s
CPU duration:     120s
Duration:         120.06s
Duration Sampled: 118.88s
Steps:            47

Hardware model:   iPad12,1
Active cpus:      6
HW page size:     16384
VM page size:     16384

Advisory levels:  Battery -> 3, User -> 3, ThermalPressure -> 0, Combined -> 3
Free disk space:  48.07 GB/59.59 GB, low space threshold 150 MB
Vnodes Available: 47.69% (4769/10000)

Preferred User Language: en-AU
Country Code:     AU
Keyboards:        en_AU QWERTY
OS Cryptex File Extents: 4

Heaviest stack for the target process:
  30  ??? (libsystem_pthread.dylib + 2968) [0x227d3cb98]
  30  ??? (libsystem_pthread.dylib + 3576) [0x227d3cdf8]
  30  ??? (libdispatch.dylib + 93712) [0x1e1a63e10]
  30  ??? (libdispatch.dylib + 49600) [0x1e1a591c0]
  30  ??? (libdispatch.dylib + 46360) [0x1e1a58518]
  30  ??? (libdispatch.dylib + 136524) [0x1e1a6e54c]
  30  ??? (libdispatch.dylib + 46360) [0x1e1a58518]
  30  ??? (libdispatch.dylib + 133168) [0x1e1a6d830]
  30  ??? (libdispatch.dylib + 16456) [0x1e1a51048]
  30  ??? (libxpc.dylib + 72652) [0x227d91bcc]
  30  ??? (libxpc.dylib + 71580) [0x227d9179c]
  30  ??? (Foundation + 6599156) [0x1d4e611f4]
  30  ??? (Foundation + 6600584) [0x1d4e61788]
  30  ??? (Foundation + 6594040) [0x1d4e5fdf8]
  30  ??? (Foundation + 711484) [0x1d48c3b3c]
  30  ??? (CoreFoundation + 133916) [0x1da450b1c]
  30  ??? (CoreFoundation + 476852) [0x1da4a46b4]
  30  ??? (ANECompilerService + 106728) [0x10006e0e8]
  30  ??? (libdispatch.dylib + 79220) [0x1e1a60574]
  30  ??? (libdispatch.dylib + 16264) [0x1e1a50f88]
  30  ??? (ANECompilerService + 108084) [0x10006e634]
  30  ??? (ANECompilerService + 104844) [0x10006d98c]
  30  ??? (ANECompilerService + 99644) [0x10006c53c]
  29  ??? (ANECompiler + 1597532) [0x239a1205c]
  29  ??? (ANECompiler + 1603732) [0x239a13894]
  17  ??? (ANECompiler + 3655344) [0x239c086b0]
  17  ??? (ANECompiler + 3154400) [0x239b8e1e0]
  15  ??? (ANECompiler + 3149656) [0x239b8cf58]
  9   ??? (ANECompiler + 3127684) [0x239b87984]
  9   ??? (ANECompiler + 3147156) [0x239b8c594]
  7   ??? (ANECompiler + 3113240) [0x239b84118]
  6   ??? (ANECompiler + 3111264) [0x239b83960]
  6   ??? (ANECompiler + 2186660) [0x239aa1da4]
  6   ??? (ANECompiler + 4384816) [0x239cba830]
  4   ??? (ANECompiler + 2201700) [0x239aa5864]
  3   ??? (ANECompiler + 4386556) [0x239cbaefc]
  1   ??? (ANECompiler + 4386228) [0x239cbadb4]



iPad, iPadOS 16

Posted on Apr 1, 2023 9:57 PM

Reply
Question marked as Top-ranking reply
User profile for user: gravityfed
gravityfed Author
User level: Level 1
146 points

Posted on May 4, 2023 4:47 AM

@Wattermellon


I have some further information, ANECompilerService is apparently a process that runs on Apple products with Adobe Creative Suite installed. ANE stands for Adobe Native Extensions which developers code for Adobe AIR applications. ANE files are libraries of native code, ANECompilerService compiles the code into an executable format. When there is an issue with the ANE compilation it may create a log entry, which is what we have found on our devices.


So, it’s a legitimate process, albeit an executable so worth keeping an eye on, HOWEVER, if you do NOT have Adobe AIR applications installed then it’s highly like either you have malware or an active exploit is using the compiler to execute code.


In my case, it has never had Adobe on the iPad (or my iPhone which it is also on). My compiler was accessing libcommonCrypto.dylib which is a cryptographic function for encryption, decryption etc and this is not something that ANECompilerService should be accessing along with other security processes. At the time of the crash it was using several system libraries and system level components. There was also the issue that the check for a root certificate failed or was invalid.


I also found evidence in other logs of security violations on the iPad. I also have a compromised MacbookPro and Mac mini (which has now been confirmed) which were both interacting with all of our iPads (also confirmed) even though they have different Adobe IDs for some devices.


The bad news is, if your appearance of the log is not for a legitimate reason then it may be impossible to get rid of, for me, Apple Store performed a full reset and it hasn’t gone away. The lastest security update which came out yesterday also did not make a difference. I run the iPad in lockdown mode but that hasn’t made any difference, they have altered the operating system.


I am waiting to hear back what the next steps are.

View in context

Similar questions

77 replies
User profile for user: LM-OB
LM-OB
User level: Level 1
8 points

May 24, 2023 9:12 PM in response to gravityfed

I have the same problem. Adobe not installed on my device either. I have 215 stacks data, of which up to 20 of these logs have been recorded in only one day. The advanced technicians at Apple Support keep trying to convince me this is ‘normal’ but of course it isn’t because the start of the log states “roots installed”.


Plus, the trust certificates are mostly root certificates of which most are not even extended validation certified.


I have apps on my device with software covered by licences with descriptions such as folly, experimental and test.


Maybe my IMSI (individual mobile subscriber identity) was accessed and test apps from an alternative App Store such as “Test Flight”.


I don’t know anything anymore, I’m losing the will to live. Honestly, this is awful because it affects ALL of your devices!!


Reply
User profile for user: Watchlistvictim
Watchlistvictim
User level: Level 1
19 points

Feb 25, 2024 8:27 AM in response to gravityfed

gravityfed,


I read a couple of your posts. They are so helpful. I might have said this before but thank you for taking the time to include this information. I wanted to share a life-changing bit of inask if you knew that there is a way to capture a sysdiagnose on an iPhone using only the iPhone itself? You may already know but I’m going to include it here as so many other users have gravitated to your posts. I mentioned this before and advised the community to “google it” but it was so helpful I wanted to post it here.


In Settings, tap Accessibility then Touch.


On the Customize Top Level Menu screen, tap the + button to add a new function and select Analytics. Analytics is now added to top menu for assist. You can tap the Back button to leave that menu.

I’ve seen a couple different ways to do this so I’m going to put here what worked for me. After turning on touch assist I went to my Home Screen then proceeded to do the following:


Press and hold both, volume up and volume down buttons and the power button until you feel a short vibration. (Has to be all three buttons.) This triggers the sysdiagnose. When you release the buttons slide to shutdown.

when the phone is turned back on double tap the assistive touch icon and “gathering analytics” appears at the top of the screen. This can take up to 10 minutes. Log files are captured. When it’s done a notification- “finished gathering Analytics” appears. Go to Settings and Analytics Data in Analytics and Privacy. Scroll down to the SysDiagnose entry and send it back to your phone. I just save to files.


I was shocked when I saw the device tree connected to my phone. The configurations and sophisticated software and processes running in my devices confirm “they” are spending enough to feed a small country with the fortune being blown to target and monitor my communications and track and follow me, a single mom with a little girl. It turns out many reporters, journals and activists are targeted like this. I’ve had a lump in my throat and a knot in my stomach since this began 5 yrs ago.


But this handy little system check was a God-send and I hope it helps someone else!


Reply

This thread has been closed by the system or the community team. You may vote for any posts you find helpful, or search the Community for additional answers.

ANECompilerService

Welcome to Apple Support Community
A forum where Apple customers help each other with their products. Get started with your Apple Account.
Learn more Sign up